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SUBJECT:  Report  on  Quality  Control  Review  of  Grant  Thomton,  LLP  Office  of 

Management  and  Budget  Circular  A- 133  Audit  Report  of  the  Center  for 
Naval  Analyses  Corporation,  Fiscal  Year  Ended  September  30, 2001 
(Report  No.  D-2003-6-004) 


We  are  providing  this  report  for  your  information  and  use.  The  audit  firm  of 
Grant  Thomton,  LLP  (Grant  Thomton)  performed  the  FY  2001  single  audit  for  the 
Center  for  Naval  Analyses  Coiporation  (CNAC),  located  in  Alexandria,  Virginia.  Office 
of  Management  and  Budget  Circular  A-133,  “Audits  of  States,  Local  Governments,  and 
Non-Profit  Organizations,”(OMB  Circular  A-133)  requires  the  audit.  CNAC  expended 
$66.6  million  in  Federal  awards  under  the  Research  and  Development  (R&D)  cluster 
during  the  fiscal  year  that  ended  September  30, 2001.  Of  the  $66.6  million,  $62.6  million 
was  expended  for  DoD  research  and  development  programs. 

Background.  CNAC  maintains  two  operating  divisions,  the  Center  for  Naval  Analyses 
(CNA)  and  the  Institute  for  Public  Research.  CNA  is  a  federally  funded  research  and 
development  center  (FFRDC)  whose  primary  focus  is  to  provide  assistance  to  the  Navy 
in  operations  and  systems  analysis.  CNA  has  conducted  research  for  the  Navy  and  other 
government  entities  since  1942  under  affiliations  with  various  universities  and  institutes. 
Effective  October  1,  1990,  CNA  was  granted  FFRDC  status  as  an  independent  entity. 

The  Institute  for  Public  Research  division  provides  resources  for  studies  and  analyses  for 
non-DoD  agencies.  CNAC  is  subject  to  the  Cost  Accounting  Standards  and  Disclosure 
Statement  requirements  in  48  Code  of  Federal  Regulation  Chapter  99.  Grant  Thomton 
has  provided  OMB  Circular  A-133  audit  services  to  CNAC  since  FY  1991.  The  Grant 
Thomton  offices  in  the  Washington,  D.C.,  area  have  performed  24  OMB  Circular  A-133 
audits  in  the  last  year. 

Quality  Control  Review  Objective.  As  the  cognizant  Federal  agency  for  CNAC,  the 
Office  of  the  Inspector  General  of  the  Department  of  Defense  (OIG  DoD)  performed  a 
quality  control  review  of  the  single  audit  report  and  supporting  working  papers  for  the 
FY  2001  CNAC  single  audit.  The  objectives  of  the  review  were  to  determine  whether  the 
audit  was  conducted  according  to  Government  Auditing  Standards  (GAS)  and  the 
auditing  and  reporting  requirements  of  OMB  Circular  A-133. 

Review  Results.  The  Grant  Thomton  auditors  did  not  meet  the  requirements  of 
OMB  Circular  A-133  and  GAS  that  related  to  the  audit  of  Federal  programs  because  the 
FY  2001  single  audit  was  not  adequately  planned,  executed,  and  documented  (finding  A 
and  finding  B).  CNAC  generally  complied  with  OMB  Circular  A-133  reporting 
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requirements,  except  that  the  Schedule  of  Expenditures  of  Federal  Awards  did  not  clearly 
identify  expenditures  received  as  pass-through  awards  or  provide  the  identifying  number 
assigned  by  the  pass-through  entities.  In  addition,  the  reporting  package  did  not  contain  a 
Summary  Schedule  of  Prior  Audit  Findings  (finding  C). 

Finding  A.  Audit  Planning  and  Performance  of  Single  Audit.  The  Grant  Thornton 
auditors  did  not  adequately  plan  and  perform  the  single  audit  of  CNAC  major  program 
Federal  awards  according  to  OMB  Circular  A- 133  requirements.  The  auditors  failed  to 
exercise  due  professional  care  because  they  did  not  perform  sufficient  procedures  to 
support  their  opinion  statements  on  compliance  with  major  program  requirements  and  on 
the  fair  representation  of  the  Schedule  of  Expenditures  of  Federal  Awards.  This 
condition  occurred  because  the  auditors  did  not: 

•  Develop  and  use  a  representative  sample  of  awards  from  the  R&D 
cluster  to  test  internal  control  over  compliance  as  well  as  compliance 
with  major  program  requirements; 

•  Review  and  consider  the  work  of  others; 

•  Identify  all  of  the  applicable  compliance  requirements; 

•  Perform  adequate  tests  of  internal  control  over  compliance  and 
compliance  with  major  program  requirements;  and 

•  Perform  adequate  audit  followup  procedures. 

As  a  result  of  the  inadequate  planning  and  performance  of  the  single  audit,  Federal 
awarding  agencies  cannot  rely  on  Grant  Thornton  audit  reports  for  assurance  that  CNAC 
is  managing  Federal  awards  in  compliance  with  laws,  regulations,  and  award  provisions. 

Audit  Coverage  and  Sampling  Methodology.  The  Grant  Thornton  auditors  did 
not  plan  for  adequate  audit  coverage  to  achieve  the  objectives  of  OMB  Circular  A- 133 
audit  of  Federal  programs.  The  auditors  selected  transactions  from  only  three  awards 
covering  two  Federal  agencies,  resulting  in  a  sample  selection  that  was  not  representative 
of  the  R&D  cluster  as  a  whole.  In  addition,  one  of  the  three  awards  selected  should  not 
have  been  included  in  the  sample  selection  because  it  was  a  fixed-price  contract  and  not 
subject  to  the  single  audit  requirements. 

The  American  Institute  of  Certified  Public  Accountants  Statements  on  Auditing 
Standards  AU  §350.17  states  that  when  planning  a  particular  sample,  the  auditor  should 
consider  the  specific  audit  objective  to  be  achieved  and  determine  the  audit  procedure,  or 
combination  of  procedures,  applied  to  achieve  that  objective.  The  auditor  should 
determine  that  the  population  from  which  the  sample  is  drawn  is  appropriate  for  the 
specific  audit  objective.  For  the  three  awards  reviewed,  the  auditors  selected  sample 
items  from  expense  and  time  sheet  reports.  The  working  papers  did  not  demonstrate  how 
the  sample  items  and  audit  procedures  achieved  the  objectives  for  the  review  of  internal 
control  and  compliance  for  each  applicable  compliance  requirement.  OMB  Circular 
A- 133  requires  assessment  of  the  level  of  control  risk.  The  working  papers  did  not 
contain  a  basis  for  how  the  selected  sample  would  achieve  a  low  level  of  assessed  control 
risk. 
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During  our  review,  Grant  Thornton  management  advised  us  that  the  firm’s  practice  was 
to  use  a  sample  of  30  transactions.  The  Grant  Thornton  auditors  originally  selected 
30  direct  cost  transactions  and  30  indirect  cost  transactions  for  testing  purposes.  The 
sample  size  was  then  revised  to  test  50  direct  cost  transactions  and  10  indirect  cost 
transactions.  To  test  for  the  allowability  of  costs,  the  auditors  inappropriately  reduced  the 
sample  size  for  indirect  costs  from  the  original  30  to  10  transactions.  Specifically,  the 
working  papers  indicate  that  the  auditors  depended  on  the  Defense  Contract  Audit 
Agency  (DCAA)  to  perform  an  incurred  cost  audit  of  CNAC  indirect  costs  as  the 
rationale  for  reducing  the  sample  size.  When  making  the  decision,  however,  the  auditors 
did  not  coordinate  with  the  DCAA.  At  the  time  the  auditors  were  performing  the 
FY  2001  single  audit,  the  DCAA  had  not  planned  or  performed  the  FY  2001  incurred 
cost  audit  for  CNAC.  As  a  result,  the  auditor’s  conclusion  that  $30  million  of  indirect 
cost  expenditures  was  allowable  was  based  on  a  sample  of  10  transactions  with  an 
approximate  value  of  $100,000. 

Unless  all  awards  from  the  R&D  cluster  are  represented  in  the  sampling  universe  and 
specific  audit  objectives  and  procedures  are  considered  when  designing  the  sample,  the 
planning  of  the  single  audit  remains  inadequate. 

Consideration  of  the  Work  of  Others.  The  Grant  Thornton  auditors  did  not 
properly  assess  and  consider  audits  and  reviews  performed  by  the  DCAA  and  the  CNAC 
internal  compliance  group.  GAS  6.14  states  that  the  auditor  should  determine  whether 
other  auditors  have  previously  done  or  are  doing  audits  of  the  program  or  entity  for 
planning  and  performing  the  audit.  If  other  auditors  have  identified  areas  that  warrant 
further  study,  that  audit  work  may  influence  an  auditor’s  selection  of  objectives  and 
methodology  as  well  as  limit  the  extent  of  their  own  testing. 

During  our  review,  we  found  that  the  auditors  did  not  consider  the  results  of  all  DCAA 
audit  reports  issued  during  CNAC’s  fiscal  year  ending  September  30,  2001.  This 
occurred  because  the  auditors  relied  solely  on  CNAC  statements  that  during  the  audit 
period  the  DCAA  had  only  issued  one  report.  However,  the  DCAA  had  issued  1 1  reports 
between  October  2000  and  September  2001.  Five  of  the  1 1  reports  identified  deficiencies 
with  compliance  with  cost  accounting  standards,  employee  compensation  policies  and 
procedures,  internal  controls  over  the  data  processing  system,  and  labor  charging.  These 
deficiencies  should  have  been  considered  in  assessing  the  risk  for  noncompliance  with 
laws  and  regulations  and  in  determining  the  nature  and  extent  of  the  compliance  testing. 

Based  on  our  review  of  the  Grant  Thornton  working  papers,  the  CNAC  internal 
compliance  group  acted  as  the  internal  audit  function  in  a  limited  capacity  and  performed 
reviews  of  time  charging  and  compliance  under  “government  contracting  standards.” 
However,  no  evidence  existed  that  Grant  Thornton  auditors  coordinated  with  the  internal 
compliance  group  to  obtain  review  results. 

As  a  result  of  Grant  Thornton’s  failure  to  assess  and  consider  the  results  of  these  audits 
and  reviews  in  their  risk  assessment  process,  we  could  not  determine  whether  the  auditors 
obtained  sufficient  evidence  to  support  their  opinion  on  compliance  with  major  program 
requirements. 

Determination  of  Applicable  Compliance  Requirements.  The  Grant  Thornton 
auditors  excluded  three  compliance  requirements  from  the  single  audit  because  the 
auditors  did  not  obtain  sufficient  knowledge  about  CNAC  operations.  The  Compliance 
Supplement  (the  Supplement)  identifies  14  compliance  requirements  applicable  to  the 
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R&D  cluster.  When  determining  not  to  test  a  requirement,  the  Supplement  requires  an 
auditor  to  conclude  why  the  requirement  does  not  apply  to  the  non-Federal  entity  or  that 
noncompliance  with  the  requirement  would  not  have  a  material  effect  on  a  major 
program. 

The  Grant  Thornton  auditor’s  determination  that  the  following  three  compliance 
requirements  were  not  applicable  to  CNAC  for  FY  2001  was  not  accurate.  The  three 
compliance  requirements  are: 

•  Equipment  and  Real  Property  Management; 

•  Subrecipient  Monitoring;  and 

•  Matching,  Level  of  Effort,  Earmarking. 

The  working  papers  document  that  the  auditors  concluded  that  the  three  compliance 
requirements  were  not  applicable  because  CNAC  did  not  purchase  any  property  with 
Federal  funds,  did  not  provide  any  funds  to  subrecipients,  and  did  not  have  contracts  with 
matching  or  level  of  effort  requirements. 

However,  CNAC  advised  us  during  our  review  that  in  FY  2001  they  had  Government- 
furnished  equipment,  had  purchased  equipment  using  Federal  funds,  and  had  provided 
$1.7  million  to  subrecipients.  Also,  delivery  orders  based  on  a  level  of  effort  could  be 
issued  on  the  FFRDC  contract.  Because  Grant  Thornton  did  not  perform  any  audit 
procedures  on  those  requirements,  we  could  not  determine  whether  the  auditors  obtained 
sufficient  evidence  to  support  their  opinion  on  compliance  with  major  program 
requirements. 

Review  of  Internal  Controls  and  Compliance.  The  Grant  Thornton  auditors  did 
not  perform  adequate  tests  of  internal  controls  and  compliance  for  the  identified 
applicable  compliance  requirements.  OMB  Circular  A- 133  and  GAS  require  that  the 
single  audit  be  planned  to  identify  and  test  internal  controls  over  Federal  programs  for  all 
compliance  requirements  relevant  to  a  major  program.  In  addition,  the  Supplement 
identifies  14  compliance  requirements  applicable  to  the  R&D  cluster  (see  Appendix  A). 
To  accomplish  this,  the  auditor  must  identify  all  of  the  applicable  and  material 
compliance  requirements,  develop  an  understanding  of  the  internal  controls  related  to  the 
objectives  of  each  compliance  requirement,  plan  tests  of  internal  controls  for  each 
requirement  to  support  a  low  assessed  level  of  control  risk,  and  perform  the  planned  tests 
of  controls.  The  auditor  uses  the  knowledge  gained  from  this  process  to  design  the  nature 
and  extent  of  compliance  testing  necessary  to  provide  the  auditor  with  sufficient  evidence 
to  support  an  opinion  on  compliance  for  a  major  program. 

The  Grant  Thornton  auditors  identified  6  of  the  14  compliance  requirements  to  be 
applicable  to  CNAC.  The  following  deficiencies  in  Grant  Thornton's  review  of  the  six 
compliance  requirements  were  present: 

Activities  Allowed  or  Unallowed  and  Allowable  Costs/Cost  Principles. 

The  auditors  did  not  identify  and  test  major  key  controls  to  meet  the  objectives  of  those 
two  compliance  requirements.  For  example,  the  objectives  of  the  compliance 
requirements  include  obtaining  assurance  that  direct  and  indirect  costs  charged  to  grants 
and  contracts  comply  with  applicable  cost  principles  for  allowability  and  allocability. 

The  tests  of  controls  the  auditors  documented  consisted  of  management  assertions  that 
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CNAC  provided  program  managers  with  training  and  a  statement  that  the  CNAC  policy 
manual  provided  guidance  on  allowable  costs  and  activities.  However,  no  evidence 
existed  in  the  working  papers  that  showed  the  auditors  performed  the  necessary 
procedures  to  corroborate  or  evaluate  the  information. 

Based  on  our  review,  no  documentation  of  procedures  existed  that  would  test  CNAC 
compliance  with  the  Cost  Accounting  Standards.  Furthermore,  the  auditors  incorrectly 
used  OMB  Circular  A- 122,  “Cost  Principles  for  Non-Profit  Organizations,”  as  the  criteria 
for  testing  the  allowability  of  payroll  costs.  CNAC  is  not  subject  to  OMB  Circular  A- 122 
cost  principles  but  rather  subject  since  1997  to  the  cost  principles  of  the  Federal 
Acquisition  Regulation  (FAR).  To  compound  the  error,  the  auditors  did  not  use  the  most 
recent  version  of  OMB  Circular  A- 122,  revised  in  June  1998. 

Period  of  Availability  of  Federal  Funds.  The  Grant  Thornton  auditors 
did  not  adequately  test  key  controls  related  to  the  requirement  objectives  and  did  not 
perform  tests  of  compliance.  Internal  control  testing  generally  consisted  of  inquiries  and 
observations,  and  the  auditors  relied  on  management  assertions  that  project  managers 
monitored  activities.  The  auditors  did  not,  however,  perform  procedures  to  determine  the 
accuracy  of  the  information.  Specifically,  the  working  papers  documented  that  the 
auditors  “observed”  that  management  had  established  procedures  to  comply  with  the 
availability  of  Federal  funds  requirement,  but  did  not  provide  specifics.  We  were  also 
unable  to  locate  any  working  papers  to  show  that  the  auditors  performed  tests  of 
compliance  for  this  requirement.  Although  the  audit  administrator  referred  us  to  a 
working  paper  that  documented  the  tests  of  “subsequent  disbursements”  for  the  financial 
statement  audit,  the  working  paper  was  not  relevant  to  testing  for  the  period  of 
availability  compliance  requirement.  Testing  for  subsequent  disbursements  ensures  that 
expenses  are  recorded  in  the  proper  period.  Testing  for  availability  of  funds  ensures  that 
the  CNAC  contractors  are  not  incurring  expenses  without  authorized  funding. 

Based  on  our  review  of  the  working  papers,  there  were  indicators  of  noncompliance  with 
the  requirement  for  availability  of  funds  that  the  auditors  failed  to  address.  The  working 
papers  made  several  references  to  unbilled  receivables  for  costs  incurred  “in  absence  of 
executed  delivery  orders  or  adequate  funding.”  CNAC  contracts  are  subject  to  the  FAR, 
and  the  FFRDC  contract  includes  clauses  that  require  the  Government  to  be  notified 
when  contract  cost  expenditures  reach  75  percent  of  estimated  costs  or  obligated  funds. 
The  requirement  is  applicable  to  each  delivery  order.  In  addition,  the  FFRDC  contract 
requires  that  the  contracting  officer  make  in  writing  all  delivery  orders  and  revisions  and 
that  work  not  begin  until  the  contracting  officer  issues  a  delivery  order.  The  contract  also 
requires  that  work  accepted  by  the  Institute  for  Public  Research,  CNAC’s  non-FFRDC 
division,  be  fully  funded.  The  Grant  Thornton  auditors  did  not  consider  these 
requirements  in  the  single  audit  and  did  not  perform  any  procedures  to  verify  CNAC 
assertions  that  cost  overruns  and  unfunded  costs  were  not  uncommon  with  the  type  of 
contract  arrangement  CNA  has  and  that  the  Navy  would  approve  the  expenditures  in  the 
near  future.  Without  approval,  the  costs  should  be  classified  as  unallowable. 

Procurement  and  Suspension  Debarment.  The  Grant  Thornton  auditors 
did  not  adequately  perform  tests  of  controls  and  compliance  to  ensure  that  CNAC  was  in 
compliance  with  the  objectives  of  the  procurement,  suspension,  and  debarment 
requirement.  The  auditors  primarily  relied  on  observations  and  inquiries  to  evaluate 
management  assertions.  Two  of  the  objectives  for  the  procurement,  suspension,  and 
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debarment  requirement  are:  determine  whether  procurements  were  made  according  to 
applicable  procurement  regulations,  and  determine  whether  non-Federal  entities  obtained 
the  required  certifications,  specifically  suspension  and  debarment  certifications. 

The  procurement  policies  should  ensure  that  contract  files  document  the  history  of  the 
procurement  including,  but  not  limited  to,  the  rationale  for  the  procurement  method, 
verification  of  full  and  open  competition,  the  basis  of  contract  price,  and  the  required 
suspension  and  debarment  certifications.  As  testing  for  the  objectives,  the  auditors 
documented  that  they  had  observed  the  procurement  manual  made  available  to  CNAC 
staff  on  the  intranet  and  concluded  that  the  manual  was  designed  to  meet  the 
requirements  of  the  FAR.  The  working  papers  also  indicate  that  the  auditors  tested  the 
requirement  as  part  of  the  tests  for  disbursements  procedures.  However,  the  referenced 
test  procedure  showed  that  the  auditors  relied  on  the  supervisor’s  approval  signature  on 
the  vouchers  as  evidence  that  the  procurement  complied  with  policies  and  procedures. 

No  documentation  existed  to  support  the  auditor  conclusion  that  the  procurement  manual 
met  the  requirements  of  the  FAR  or  that  the  auditors  reviewed  contract  files  to  verify  the 
history  of  the  procurement,  method  of  procurement,  basis  of  contract  price,  and  whether 
the  procurement  provided  for  full  and  open  competition.  In  addition,  the  auditors  did  not 
perform  adequate  procedures  to  validate  that  CNAC  obtained  required  suspension  and 
debarment  certificates.  Auditors  observed  that  CNAC  procurement  staff  had  online 
access  to  the  Government’s  “List  of  Parties  Excluded  from  Federal  Procurement  or 
Non-procurement  Programs,”  but  the  auditors  did  not  review  the  procurement  files  for 
the  required  certifications  or  check  a  sample  of  procurements  against  the  published 
Government  list. 

Reporting.  Auditors  did  not  perform  adequate  procedures  to  support  their 
conclusion  that  CNAC  was  in  compliance  with  the  reporting  requirement.  The  auditors 
did  not  design  or  perform  procedures  to  determine  whether  required  reports  were 
complete,  accurate,  and  submitted  in  a  timely  manner.  This  condition  occurred  because 
the  auditors  did  not  obtain  a  sufficient  knowledge  about  the  types  of  reports  and 
submission  requirements  in  CNAC  contracts. 

The  working  paper  documentation  for  the  review  of  internal  controls  and  compliance 
showed  that  the  auditor’s  conclusion  that  CNAC  was  in  compliance  with  this  requirement 
generally  consisted  of  broad  management  statements  that  the  auditor  did  not  confirm. 

The  objective  of  the  reporting  requirement  is  to  determine  that  reports  submitted  to 
awarding  agencies  and  pass-through  entities  include  all  activity  for  the  reporting  period 
and  are  supported  by  applicable  accounting  records.  The  working  papers  referenced  tests 
of  the  disbursement  and  payroll  process  and  consisted  of  tracing  transactions  from  the 
accounts  payable  check  register  and  payroll  journal  to  the  general  ledger.  The  tests  did 
not  provide  assurance  for  the  objectives  of  the  reporting  requirement. 

Special  Tests  and  Provisions.  The  Grant  Thornton  auditors  did  not 
perform  adequate  procedures  to  determine  that  CNAC  had  effective  internal  controls  in 
place  to  ensure  compliance  with  the  contract  provisions.  The  auditors  did  not  adequately 
identify  and  test  significant  special  contract  provisions,  and  the  documented  tests  of 
internal  controls  generally  consisted  of  broad  management  assertions  and  auditor 
observations. 
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The  auditors  did  not  identify  many  of  the  special  contract  provisions  designed  to  address 
the  unique  nature  of  the  FFRDC  contracting  environment.  Some  of  the  provisions  that 
the  auditor  failed  to  identify  and  test  include  restrictions  on  CNA  initiated  projects  and 
reporting  requirements  on  the  related  projects;  requirements  for  approval  to  use 
consultants  and  subcontractors,  including  specific  approval  considerations  for  former 
senior  government  officials;  and  minimum  educational  requirements  for  employees  and 
consultants. 

Auditor  testing  of  compliance  for  three  contract  provisions  was  inadequate.  The  FFRDC 
contract  limits  certain  costs  for  employees  on  educational  leave  and  for  employees 
detained  overseas.  The  contract  also  requires  that  CNAC  provide  the  contracting  officer 
with  reports  on  activities  the  Institute  for  Public  Research  performed.  As  support  for  the 
testing  of  internal  controls  over  the  Special  Tests  and  Provisions  compliance  requirement, 
the  working  papers  provided  only  descriptions  of  certain  contract  provisions.  The 
working  papers  did  not  provide  any  specifics  on  the  audit  procedures  performed  to  test 
compliance  with  the  contract  provisions.  Furthermore,  we  could  not  find  any  correlation 
between  the  disbursement  and  payroll  transactions  selected  for  testing  and  how  the  same 
transactions  would  achieve  the  testing  objectives  for  compliance  with  the  Special  Tests 
and  Provision  compliance  requirement.  The  working  papers  concluded  that  the  Special 
Tests  and  Provision  compliance  requirement  was  met  based  on  inquiries  with  CNAC 
personnel  that  the  contract  administrator  received  reports  in  a  timely  manner.  However, 
no  evidence  existed  in  the  working  papers  to  indicate  that  the  auditors  verified  the 
number  of  reports  that  should  have  been  submitted  or  that  the  contracting  officer  actually 
received  the  reports  in  a  timely  manner. 

Performing  Audit  Followup  Procedures.  The  Grant  Thornton  auditors  did  not 
exercise  professional  skepticism  because  they  did  not  perform  adequate  audit  followup 
procedures  concerning  an  occurrence  of  employee  theft,  unresolved  DCAA  findings  and 
questioned  costs  from  prior  years,  and  a  pending  investigation  on  the  hiring  of  two 
Government  officials.  The  American  Institute  of  Certified  Public  Accountants  Statement 
on  Auditing  Standards  AU  §230.08  states  that  when  gathering  and  objectively  evaluating 
audit  evidence,  the  auditor  is  required  to  consider  the  competency  and  sufficiency  of  the 
evidence.  Because  evidence  is  gathered  and  evaluated  throughout  an  audit,  professional 
skepticism  should  be  exercised  throughout  the  audit  process.  At  the  beginning  of  the 
single  audit,  CNAC  management  informed  the  auditors  about  an  employee  theft  that 
occurred  over  a  period  of  4  years  and  CNAC  estimated  the  loss  at  $50,000.  CNAC 
management  stated  that  new  policies  and  procedures  were  implemented  to  correct  the 
breakdown  in  internal  controls  and  that  the  audit  committee  was  informed  of  the 
employee  theft.  We  did  not  find  any  indications  that  the  auditors  performed  any 
followup  procedures  to  confirm  CNAC  assertions.  Our  review  of  the  minutes  for  the 
Board  of  Trustees  meetings  in  FY  200 1  showed  no  evidence  that  CNAC  management 
informed  the  audit  committee  of  the  employee  theft.  In  addition,  as  a  result  of  the 
employee  theft,  the  auditors  should  have  considered  the  impact  of  this  particular  known 
fraud  in  the  single  audit  planning  process.  We  found  no  evidence  to  indicate  that  this  had 
occurred. 

The  Grant  Thornton  working  papers  document  information  on  DCAA  findings  and 
questioned  costs  from  prior  years  that  remain  unresolved,  and  the  auditors  used  that 
information  to  verify  the  reasonableness  of  the  reserve  for  unallowable  costs  for  the 
financial  statement  audit.  However,  no  evidence  existed  in  the  working  papers  that  the 
auditors  performed  procedures  to  verify  CNAC  assertions  on  the  status  of  the  unresolved 
issues. 
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The  Grant  Thornton  auditors  were  notified  in  the  CNAC  management  letter  that  CNAC 
was  under  investigation  for  possible  violations  in  hiring  two  former  Government 
officials.  CNAC  asserted  that  the  result  would  not  have  a  material  effect  on  the  financial 
statements.  The  working  papers  document  that  outside  counsel  for  CNAC  confirmed  the 
status  of  the  investigation  but  did  not  comment  on  any  loss  contingency.  The  auditors  did 
not  perform  any  other  audit  procedures  to  verify  the  CNAC  assertion. 

Schedule  of  Expenditures  of  Federal  Awards.  The  working  papers  did  not 
provide  sufficient  evidence  that  Grant  Thornton  performed  the  steps  necessary  to  support 
the  audit  opinion  that  the  Schedule  of  Expenditures  of  Federal  Awards  was  fairly 
presented  in  all  material  respects  in  relation  to  the  financial  statements  taken  as  a  whole. 
Specifically,  the  working  papers  did  not  contain  an  objective,  scope,  and  methodology, 
and  did  not  document  the  work  performed  as  it  relates  to  the  audit  objectives.  We  could 
not  determine  on  some  of  the  working  papers  the  source  of  the  information,  what  analysis 
was  performed,  and  the  purpose,  relevance,  and  conclusion  of  the  analysis  as  it  related  to 
the  Schedule  of  Expenditures  of  Federal  Awards.  As  a  result,  we  had  no  assurance  that 
the  Schedule  of  Expenditures  of  Federal  Awards  was  complete  and  accurate. 

Summary.  The  Grant  Thornton,  LLP  audit  work  does  not  meet  the  requirements  of 
OMB  Circular  A- 133,  the  related  Compliance  Supplement,  and  GAS  auditing  standards. 
As  a  result,  Federal  agencies  and  pass-through  entities  cannot  rely  on  the  CNAC  audit 
report  to  monitor  and  manage  Federal  awards. 

Based  on  the  deficiencies,  we  conclude  that  the  audit  team  members  lacked  an 
understanding  of  the  requirements  for  performing  audits  in  accordance  with  GAS  and  the 
OMB  Circular  A- 133  audit  requirements.  Although  the  audit  team  members  met  the 
required  24  hours  of  continued  professional  education,  we  believe  that  additional  training 
related  to  GAS  and  OMB  Circular  A- 133  audits  should  be  provided  to  team  members 
engaged  in  such  audits.  In  addition,  proper  supervision  should  have  ensured  that  the 
audit  was  conducted  according  to  GAS  and  OMB  Circular  A- 133  requirements. 

Recommendation  A.l.  We  recommend  that  the  Controller,  Center  for  Naval  Analyses 
Corporation: 

a.  Direct  Grant  Thornton,  LLP  to  perform  additional  audit  procedures  to  address 
the  specific  deficiencies  identified  in  this  report  and  revise  the  reporting  package  to 
reflect,  at  a  minimum,  the  date  the  work  is  completed.  The  additional  audit  procedures 
should  satisfy  the  terms  of  the  engagement  letter  for  the  single  audit  of  the  Center  for 
Naval  Analyses  Corporation  for  the  fiscal  year  ended  September  30,  2001,  and  be 
performed  at  no  additional  cost  to  the  Federal  Government. 

b.  Notify  the  Office  of  the  Inspector  General  of  the  Department  of  Defense  when 
Grant  Thornton  provides  the  revised  reporting  package  to  CNAC  so  that  we  can  perform 
a  followup  quality  control  review  before  submission  of  the  revised  FY  2001  single  audit 
reporting  package  to  the  Federal  Audit  Clearinghouse. 

c.  Identify  as  unallowable  any  costs  associated  with  audit  services  Grant 
Thornton,  LLP  provided  related  to  the  FY  2001  single  audit  until  they  perform  an 
adequate  audit  as  determined  by  our  office. 

Management  Comments.  We  request  that  CNAC  management  provide  comments  to 
the  recommendation  and  corrective  actions  planned  or  taken  by  February  28,  2003. 
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Recommendation  A.2.  We  recommend  that  the  Partner  in  Charge,  Grant  Thornton, 
LLP: 


a.  Perform  additional  audit  procedures  and  revise  the  reporting  package  to  reflect, 
at  a  minimum,  the  date  the  work  is  completed  to  satisfy  Government  Auditing  Standards 
and  the  Office  of  Management  and  Budget  Circular  A- 133  requirements.  The  additional 
audit  procedures  should  address  the  specific  deficiencies  identified  in  this  report.  The 
revised  reporting  package  should  be  provided  to  CNAC. 

Management  Comments.  Grant  Thornton  management  nonconcurred,  stating  that  they 
believed  that  the  2001  audit  of  CNAC  complied  with  professional  standards  and  the 
requirements  of  the  Office  of  Management  ad  Budget  Circular  A- 133  related  to  the  audit 
of  Federal  programs.  Grant  Thornton  believed  that  the  extent  of  the  procedures  requested 
by  the  Inspector  General  (IG)  is  generally  in  excess  of  the  professional  standards  and  the 
requirements  of  Office  of  Management  and  Budget  Circular  A- 133.  However,  Grant 
Thornton  agreed  to  perform  certain  additional  procedures  requested  by  the  IG  in  order  to 
meet  the  IG  requirements.  Grant  Thornton  will  provide  the  additional  information 
directly  to  the  IG  for  review  and  acceptance  prior  to  inclusion  in  the  2001  workpapers. 

Evaluation  Response.  We  disagree  with  Grant  Thornton  that  their  FY  2001  single  audit 
of  CNAC  met  Government  Auditing  Standards  and  the  Office  of  Management  and 
Budget  Circular  A- 133  audit  requirements.  The  audit  standards  and  requirements  for  a 
single  audit  are  established  in  the  Government  Auditing  Standards  and  the  Office  of 
Management  and  Budget  Circular  A- 133,  not  by  the  IG  office.  Our  reported  findings  are 
based  on  the  review  of  working  papers  prepared  by  Grant  Thornton  auditors  during  the 
audit  engagement.  We  consider  those  working  papers  as  the  record  of  the  procedures 
applied,  the  tests  performed,  the  information  obtained,  and  the  conclusions  reached  in  the 
audit.  We  intend  to  perform  a  followup  quality  control  review  after  Grant  Thornton 
provides  CNAC  with  the  revised  reporting  package.  We  will  review  the  Grant  Thornton 
working  papers  for  the  additional  audit  procedures  at  that  time. 

Finding  B.  Documentation  of  Audit  Work  Performed.  The  Grant  Thornton  auditors 
did  not  adequately  document  the  audit  work  performed  for  the  single  audit  of  CNAC  for 
the  fiscal  year  ending  September  30,  2001,  because  they  did  not  comply  with  GAS 
requirements  for  working  papers.  Specifically,  the  Grant  Thornton  auditors  did  not 
adequately  document  the  sampling  methodology  for  the  selection  of  transactions;  and  did 
not  adequately  document  the  testing  of  internal  controls  and  compliance  with  the 
compliance  requirements. 

GAS  Working  Paper  Requirements.  GAS  requires  that  working  papers  contain 
sufficient  information  to  enable  an  experienced  auditor  with  no  previous  connection  with 
the  audit  to  ascertain  the  evidence  that  supports  an  auditor’s  significant  conclusions  and 
judgments.  Working  papers  should  contain  objectives,  scope,  and  methodology  as  well 
as  any  sampling  criteria  used.  The  working  papers  should  also  contain  documentation  of 
the  work  performed,  including  descriptions  of  transactions  and  records  examined,  that 
would  enable  an  experienced  auditor  to  examine  the  same  transactions  and  records. 

Sampling  Methodology.  The  Grant  Thornton  working  papers  did  not  adequately 
document  the  methodology  used  to  establish  their  sample  for  the  single  audit  of  CNAC 
for  FY  2001.  Although  the  working  papers  showed  the  number  of  direct  and  indirect  cost 
transactions  to  be  tested,  the  working  papers  did  not  document  how  the  selected 
transactions  would  accomplish  the  testing  of  objectives  for  internal  control  over  financial 
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reporting  and  internal  control  and  compliance  with  the  R&D  cluster  requirements.  For 
example,  our  review  of  the  FFRDC  contract  between  CNAC  and  the  Navy  showed  that 
special  requirements  existed  that  the  Grant  Thornton  auditors  should  have  considered  for 
testing  purposes  when  establishing  their  sample.  Some  of  the  special  requirements 
included  submitting  certification  of  compliance  for  performing  non-FFRDC  work; 
obtaining  prior  approval  to  use  and  charge  consultants/subcontractors  to  CNA  projects; 
and  that  the  total  reimbursement  for  salaries,  fringe  benefits,  tuition  and  fees  for 
personnel  on  education  or  administrative  leave  did  not  exceed  3  percent  of  total  costs. 

The  working  paper  that  Grant  Thornton  auditors  developed  to  document  their  sampling 
did  not  address  these  requirements. 

Internal  Controls  Over  Compliance  Requirements.  The  Grant  Thornton 
working  papers  did  not  contain  sufficient,  competent,  and  relevant  evidence  to  support 
their  conclusions  and  judgments  for  the  test  of  internal  controls  over  the  compliance 
requirements.  The  working  papers  documented  observations  and  inquiries  the  auditors 
performed  but  did  not  include  specific  information  such  as  the  names  of  the  individuals 
interviewed,  documents  reviewed,  or  procedures  observed.  The  working  papers  also  did 
not  contain  auditor  conclusions  of  key  controls  tested  for  support  of  the  overall  control 
risk  assessment  for  the  compliance  requirements  that  the  auditors  identified  as  applicable 
to  the  major  program.  For  example,  auditors  documented  “we  have  observed  that  the 
accounting  system  allows  for  the  segregation  of  allowable  and  unallowable  costs,”  as 
testing  for  one  of  several  key  controls  for  the  Allowed  Cost/Cost  Principles  and  Activities 
Allowed/Unallowed  compliance  requirements.  As  documentation  for  the  test  of  a  key 
control  for  the  Procurement  and  Suspension  and  Debarment  compliance  requirement,  the 
auditors  indicated  that,  “We  have  observed  that  procurement  staff  have  the  ‘Lists  of 
Excluded  Parties’  available  in  an  online  format.”  Those  statements  do  not  provide 
sufficient  evidence  to  support  the  auditor’s  conclusion  that  controls  for  the  two 
compliance  requirements  were  operating  effectively. 

Compliance  Requirements.  The  working  papers  did  not  adequately  document 
the  review  and  audit  conclusions  for  the  testing  of  the  six  compliance  requirements  that 
the  Grant  Thornton  auditors  tested.  The  working  papers  referenced  for  the  testing  of  the 
six  compliance  requirements  did  not  provide  sufficient  evidence  to  support  the  auditor’s 
conclusion  that  CNAC  was  in  compliance  with  requirement  objectives. 

For  the  testing  of  the  Allowable  Cost/Cost  Principles  and  Activities  Allowed  or 
Unallowed  requirements,  the  working  papers  did  not  adequately  document  the  procedures 
performed  for  establishing  compliance  with  the  compliance  requirements.  Specifically, 
the  working  papers  mentioned  a  number  of  “observations”  by  the  Grant  Thornton 
auditors,  and  the  audit  procedures  performed  were  primarily  designed  to  test  the 
disbursement  and  payroll  systems/processes.  The  working  papers  did  not  document 
specific  audit  procedures  performed  and  documents  reviewed  to  assess  the  allowability  of 
the  costs  against  the  cost  principle  criteria  of  the  FAR  or  the  terms  and  conditions  of  the 
contracts.  In  addition,  to  identify  the  working  papers  that  demonstrated  the  testing  of  the 
Period  of  Availability  compliance  requirement,  we  needed  verbal  explanations  from  the 
Grant  Thornton  audit  administrator.  Without  the  audit  administrator,  we  would  not  have 
been  able  to  associate  the  working  paper  with  the  testing  for  the  Period  of  Availability 
compliance  requirement.  The  audit  procedure  identified  in  the  working  paper  did  not 
address  the  objectives  of  the  compliance  requirement,  and  the  working  paper  did  not 
contain  a  conclusion  relevant  to  the  compliance  requirement. 
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Recommendation  B.  We  recommend  that  the  Partner  in  Charge,  Grant  Thornton,  LLP: 

1 .  Review  the  working  papers  supporting  the  additional  audit  procedures 
performed  for  the  FY  2001  Office  of  Management  and  Budget  Circular  A- 133  audit  to 
ensure  that  they  are  prepared  in  accordance  with  Government  Auditing  Standards  and 
include  the  objectives,  scope  and  methodology,  as  well  as  work  performed  including 
descriptions  of  transactions  and  records  examined  to  support  significant  conclusions  and 
judgments  reached. 

Management  Comments.  Grant  Thornton  stated  that  they  believe  that  the  level  of 
documentation  requested  by  the  IG  is  generally  in  excess  of  the  professional  standards 
and  the  requirements  of  the  Office  of  Management  Budget  Circular  A- 133.  However, 
Grant  Thornton  agreed  to  provide  additional  documentation  with  respect  to  auditing 
procedures,  audit  considerations,  and  audit  conclusions  already  performed  and  reached  by 
Grant  Thornton  during  the  2001  audit. 

Evaluation  Response.  OMB  Circular  A- 133  § _ 500  requires  that  audits  be  conducted  in 

accordance  with  Government  Auditing  Standards.  Grant  Thornton  is  subject  to  and  did 
not  meet  the  documentation  requirements  of  the  Government  Auditing  Standards.  The 
documentation  requirements  for  a  single  audit  are  established  in  the  Government 
Auditing  Standards,  not  by  the  IG  office.  We  cannot  consider  and  accept  significant 
supplemental  working  papers  created  more  than  one  year  later  as  evidence  for  the  work 
performed  during  the  initial  2001  single  audit  engagement.  However,  we  will  review  the 
Grant  Thornton  working  papers  for  the  additional  audit  procedures  performed  to 
determine  whether  the  single  audit  meets  the  requirements  of  Government  Auditing 
Standards  and  the  Office  of  Management  and  Budget  Circular  A- 133. 

Finding  C.  OMB  Circular  A-133  Reporting  Package.  CNAC  did  not  submit  a 
complete  reporting  package  for  FY  2001  to  the  Federal  Audit  Clearinghouse  as  required 
by  OMB  Circular  A-133.  The  package  did  not  present  a  clear  Schedule  of  Expenditures 
of  Federal  Awards.  The  package  also  did  not  contain  a  Summary  Schedule  of  Prior  Audit 
Findings. 

Schedule  of  Expenditures  of  Federal  Awards.  CNAC  did  not  clearly  present  in 
the  Schedule  of  Expenditures  of  Federal  Awards  expenditures  received  as  pass-through 
awards  or  the  identifying  number  the  pass-through  entities  assigned.  As  a  result,  Federal 
awarding  agencies  and  pass-through  entities  may  have  difficulty  using  the  information  in 
the  Schedule  to  monitor  their  awards. 

Summary  Schedule  of  Prior  Audit  Findings.  CNAC  did  not  include  a 
Summary  Schedule  of  Prior  Audit  Findings  in  the  OMB  Circular  A-133  reporting 
package  for  open  DCAA  audit  findings  for  FY  1997  through  FY  1999. 

Recommendation  C.  We  recommend  that  the  Controller,  Center  for  Naval  Analyses 
Corporation: 

1.  Prepare  the  Schedule  of  Expenditures  of  Federal  Awards  and  a  Summary 
Schedule  of  Prior  Audit  Findings  according  to  the  Office  of  Management  and  Budget 
Circular  A-133  requirements  and  provide  those  documents  to  Grant  Thornton,  LLP  for 
the  performance  of  additional  audit  procedures  for  the  FY  2001  Office  of  Management 
and  Budget  Circular  A-133  audit. 
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2.  Prepare  the  Schedule  of  Expenditures  of  Federal  Awards  according  to  the 
Office  of  Management  and  Budget  Circular  A-133  requirements,  specifically  to  include 
pass-through  entity  information. 

3.  Prepare  a  Summary  Schedule  of  Prior  Audit  Findings:  (1)  and  provide  to  the 
auditors  performing  future  Office  of  Management  and  Budget  Circular  A-l  33  audits,  and, 
(2)  include  when  appropriate,  in  any  future  Office  of  Management  and  Budget  Circular 
A-133  audit  reporting  packages  that  are  submitted  to  the  Federal  Audit  Clearinghouse. 

Management  Comments.  CNAC  management  concurred  and  agreed  to  implement  the 
recommendations  as  stated. 

We  appreciate  the  courtesies  extended  to  the  audit  staff.  For  additional  information  on 
this  report,  please  contact  Ms.  Janet  Stem  at  (703)  604-8750  (DSN  664-8750)  or 
Ms.  Carolyn  R.  Davis  at  (703)  604-8877  (DSN  664-8877).  See  Appendix  B  for  the 
report  distribution.  The  review  team  members  are  listed  inside  the  back  cover  of  the 
report. 


Deputy  Assistant  Inspector  General 
for  Audit  Policy  and  Oversight 
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Appendix  A.  Quality  Control  Review  Process 


Scope  and  Methodology 

We  conducted  a  quality  control  review  of  the  Grant  Thornton,  LLP  audit  of  CNAC  for 
the  fiscal  year  ended  September  30,  2001,  and  the  resulting  reporting  package  that  was 
submitted  to  the  Federal  Audit  Clearinghouse  dated  June  3,  2002.  We  performed  our 
review  using  the  1999  edition  of  the  “Uniform  Quality  Control  Guide  for  the  A- 133 
Audits”  (the  Guide).  The  Guide  applies  to  any  single  audit  that  is  subject  to  the 
requirements  of  OMB  Circular  A-133  and  is  the  approved  President’s  Council  on 
Integrity  and  Efficiency  checklist  used  for  performing  the  quality  control  reviews.  Our 
review  was  conducted  from  June  2002  through  January  2003  and  covered  areas  related 
primarily  to  the  audit  of  the  CNAC  R&D  cluster.  As  the  cognizant  agency  for  CNAC, 
we  focused  our  review  on  the  following  qualitative  aspects  of  the  single  audit: 

•  Qualification  of  auditors 

•  Independence 

•  Due  professional  care 

•  Planning  and  supervision 

•  Internal  control  and  compliance  testing 

•  Schedule  of  Expenditures  of  F ederal  Awards 

•  Schedule  of  Findings  and  Questioned  Costs 

•  Summary  Schedule  of  Prior  Audit  Findings 

•  Data  Collection  Form 

In  conducting  our  review,  we  reviewed  the  working  papers  Grant  Thornton,  LLP 
prepared  as  well  as  audit  reports  the  DCAA  auditors  prepared.  We  also  discussed  the 
audit  with  the  Grant  Thornton,  LLP  auditors  and  CNAC  personnel  and  retested  selected 
sample  transactions. 

Prior  Quality  Control  Reviews 

Since  1996  we  have  issued  three  quality  control  review  reports  of  OMB  Circular  A-133 
audits  that  Grant  Thornton  performed.  In  our  report  issued  in  February  2001,  we  reported 
that  the  Grant  Thornton  audit  documentation  did  not  meet  GAS  requirements. 

Specifically,  we  could  not  rely  on  the  working  papers  to  determine  that  the  audit  was 
adequately  planned  and  performed  to  meet  OMB  Circular  A-133  requirements.  The 
nature  and  extent  of  the  deficiencies  were  discussed  with  Grant  Thornton  at  that  time. 
Significant  verbal  explanations  were  required  to  establish  that  the  audit  met  the  intent  of 
the  single  audit  requirements.  We  elected  to  omit  some  of  the  deficiencies  as  report 
findings  from  the  February  2001  report  by  accepting  verbal  explanations  and 
supplemental  working  papers  provided  by  Grant  Thornton  to  establish  the  adequacy  of 
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the  audit.  As  a  result  of  the  verbal  discussions,  Grant  Thornton  took  actions  to  prevent 
similar  deficiencies  from  occurring  in  future  audits.  Grant  Thornton  provided  single 
audit  training  and  developed  a  matrix  intended  to  fully  document  the  identification  and 
testing  of  compliance  requirement  key  internal  controls.  Despite  corrective  actions  taken, 
similar  deficiencies  were  found  in  the  current  OMB  Circular  A- 133  audit  of  CNAC. 
Copies  of  Inspector  General  of  the  Department  of  Defense  (IG  DoD)  reports  can  be 
accessed  over  the  Internet  at  http://www.dodig.osd.mil/audits/reports. 

Single  Audit  Requirements 

The  intention  of  the  Single  Audit  Act,  Public  Law  98-502,  as  amended,  and  OMB 
Circular  A- 133  was  to  improve  the  financial  management  of  state  and  local  governments 
and  non-profit  organizations.  The  Single  Audit  Act  and  OMB  Circular  A- 133  establishes 
one  uniform  set  of  auditing  and  reporting  requirements  for  all  Federal  award  recipients 
required  to  obtain  a  single  audit.  OMB  Circular  A- 133  establishes  policies  that  guide 
implementation  of  the  Single  Audit  Act  and  provides  an  administrative  foundation  for 
uniform  audit  requirements  of  non-Federal  entities  administering  Federal  awards. 

OMB  Circular  A- 133  requires  that  Federal  departments  and  agencies  rely  on  and  use  the 
single  audit  work  to  the  maximum  extent  practicable.  Entities  that  expend  $300,000  or 
more  of  Federal  awards  in  a  fiscal  year  are  subject  to  the  Single  Audit  Act  and  the  audit 
requirements  in  OMB  Circular  A- 133  and,  therefore,  must  have  a  annual  single  or 
program-specific  audit  performed  under  GAS.  To  meet  the  intent  of  the  law  and 
OMB  Circular  A- 133  requirements,  the  auditee  (non-Federal  entity)  submits  to  the 
Federal  Audit  Clearinghouse  a  complete  reporting  package  and  a  Data  Collection  Form 
on  each  single  audit.  The  submission  includes  the  following: 

•  Data  Collection  Form,  certified  by  the  auditee  that  the  audit  was  completed  in 
accordance  with  the  OMB  Circular  A- 133; 

•  Financial  statements  and  related  opinion; 

•  Schedule  of  Expenditures  of  Federal  Awards  and  related  opinion; 

•  Report  on  compliance  and  internal  control  over  financial  reporting; 

•  Report  on  internal  control  over  compliance  for  major  programs; 

•  Report  on  compliance  with  requirements  for  major  programs  and  related 
opinion; 

•  Schedule  of  Findings  and  Questioned  Costs; 

•  Summary  Schedule  of  Prior  Audit  Findings;  and 

•  A  corrective  action  plan,  when  appropriate. 

The  OMB  Compliance  Supplement  (the  Supplement)  assists  auditors  to  identify 
compliance  requirements  the  Federal  Government  expects  to  be  considered  as  part  of  the 
single  audit.  For  each  compliance  requirement,  the  Supplement  describes  the  related 
audit  objectives  that  the  auditor  shall  consider  in  each  audit  conducted  under  OMB 
Circular  A- 133  as  well  as  suggested  audit  procedures.  The  Supplement  also  describes  the 
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objectives  of  internal  control  and  characteristics  that,  when  present  and  operating 
effectively,  may  ensure  compliance  with  program  requirements.  The  following  14 
compliance  requirements  identified  in  the  Supplement  are  applicable  to  the  R&D  cluster. 

A.  Activities  Allowed/Unallowed 

B.  Allowable  Costs/Cost  Principles 

C.  Cash  Management 

D.  Davis-Bacon  Act 

E.  Eligibility 

F.  Equipment  and  Real  Property  Management 

G.  Matching,  Level  of  Effort,  Earmarking 

H.  Period  of  Availability  of  Federal  Funds 

I.  Procurement  and  Suspension  and  Debarment 

J.  Program  Income 

K.  Real  Property  Acquisition  and  Relocations  Assistance 

L.  Reporting 

M.  Subrecipient  Monitoring 

N.  Special  Tests  and  Provisions 

The  Statement  of  Position  98-3,  “Audits  of  States,  Local  Governments,  and 
Not-for-Profit  Organizations  Receiving  Federal  Awards,”  published  by  the  American 
Institute  of  Certified  Public  Accountants,  provides  guidance  on  auditor  responsibilities 
for  conducting  audits  according  to  the  Single  Audit  Act  and  OMB  Circular  A- 133.  In 
general,  the  Statement  of  Position  98-3  provides  auditors  with  an  understanding  of  the 
unique  planning,  performance,  and  reporting  considerations  for  single  audits  performed 
under  GAS.  In  addition,  the  Statement  of  Position  98-3  uses  summary  tables  and  detailed 
discussions  to  provide  the  auditor  with  an  understanding  of  the  additional  general, 
fieldwork,  and  reporting  requirements  under  GAS,  including  the  additional  standards 
relating  to  quality  control  systems,  continuing  professional  education,  working  papers, 
audit  followup  and  reporting. 

The  Statement  of  Position  98-3  emphasizes  that  when  planning  an  audit  to  meet  the 
requirements  of  OMB  Circular  A- 133,  several  factors  should  be  considered  in  addition  to 
those  ordinarily  associated  with  an  audit  of  financial  statements  in  accordance  with 
Generally  Accepted  Auditing  Standards  and  GAS.  The  factors  include  but  are  not  limited 
to: 


•  Determining  that  the  Schedule  of  Expenditures  of  Federal  Awards  is  presented 
fairly  in  relation  to  the  financial  statements; 

•  Determining  major  programs  for  audit  using  a  risk-based  approach; 

•  Determining  compliance  requirements; 

•  Gaining  an  understanding  of  internal  control  over  Federal  programs; 

•  Testing  internal  control  over  major  programs; 
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•  Determining  compliance  with  laws,  regulations,  and  the  provisions  of  contract 
or  grant  agreements  that  have  a  direct  and  material  effect  on  each  major 
program; 

•  Satisfying  the  additional  requirements  of  the  Single  Audit  Act  and  OMB 
Circular  A- 133  regarding  working  papers,  audit  followup,  and  reporting. 
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Appendix  B.  Report  Distribution 

Office  of  the  Secretary  of  Defense 

Under  Secretary  of  Defense  for  Acquisition,  Technology,  and  Logistics 
Director,  Defense  Procurement 


Other  Defense  Organizations 

Director,  Defense  Contract  Audit  Agency 


Department  of  the  Navy 

Chief,  Office  of  Naval  Research 
Audit  Liaison,  Assistant  Secretary  of  the  Navy 
Financial  Management  and  Comptroller 
Naval  Inspector  General 


Other  Federal  Agencies 

Office  of  the  Inspector  General,  National  Science  Foundation 
Office  of  the  Inspector  General,  Central  Intelligence  Agency 
Office  of  the  Inspector  General,  Department  of  Transportation 
Regional  Inspector  General  for  Auditing,  General  Services  Administration 


Non-Government  Organizations 

Board  of  Trustees,  The  CNA  Corporation 
Audit  Committee,  The  CNA  Corporation 
CFO  and  Treasurer,  The  CNA  Corporation 
Assistant  Controller,  The  CNA  Corporation 
Partner,  Grant  Thornton,  LLP 
Partner  in  Charge,  Grant  Thornton,  LLP 
Senior  Manager,  Grant  Thornton,  LLP 

Board  of  Directors,  American  Institute  of  Certified  Public  Accountants 


Congressional  Committees  and  Subcommittees,  Chairman  and 
Ranking  Minority  Member 

Senate  Committee  on  Appropriations 

Senate  Subcommittee  on  Defense,  Committee  on  Appropriations 
Senate  Committee  on  Armed  Services 

Senate  Subcommittee  on  Acquisition  and  Technology,  Committee  on  Armed  Services 
Senate  Committee  on  Governmental  Affairs 
House  Committee  on  Appropriations 

House  Subcommittee  on  Defense,  Committee  on  Appropriations 
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Congressional  Committees  and  Subcommittees,  Chairman  and 
Ranking  Minority  Member  (cont’d) 

House  Committee  on  Armed  Services 
House  Committee  on  Government  Reform 

House  Subcommittee  on  Government  Efficiency,  Financial  Management,  and 
Intergovernmental  Relations 

House  Subcommittee  on  National  Security,  Veterans  Affairs,  and  International  Relations, 
Committee  on  Government  Reform 
House  Subcommittee  on  Technology  and  Procurement  Policy 
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CNA  Corporation  Comments 


■CNA 

Corporation  A  Non-Profit  Research  and  Analysis  Corporation 


4825  Mark  Center  Drive  *  Alexandria,  Virginia  2251 1-1850  •  (703)  824-2Q00  •  (705)  824,^2949  FAX 


November  26, 2002 


Inspector  General 
Department  of  Defense 
400  Army  Navy  Drive 
Arlington,  VA  22202-2884 

Attention:  Ms.  Sharon  Vasquez 

Subject:  Draft  Report  on  Quality  Control  Review  of  Grant  Thornton  LLP  Office  of  Management  and 
Budget  Circular  A-1 33  Audit  Report  of  The  CNA  Corporation,  Fiscal  Year  Ended  September  30, 2001 

Dear  Ms.  Sharon  Vasquez: 

We  will  ensure  that  all  Schedule  of  Expenditures  of  Federal  Awards  prepared  in  the  future  clearly 
identify  pass-through  entities  and  the  identification  number  assigned  by  the  pass-through  entities. 
Further,  we  will  ensure  that  open  DCAA  audit  findings  are  included  in  the  Summary  Schedule  of  Prior 
Audit  Findings,  which  is  part  of  the  OMB  Circular  A-133  audit  reporting  packages  submitted  to  the 
Federal  Audit  Clearinghouse. 

We  also  agree  to  prepare  revised  FY  2001  Schedule  of  Expenditures  of  Federal  Awards  and  Summary 
Schedule  of  Prior  Audit  Findings  according  to  the  specifications  stated  above.  These  reports  will  be 
provided  to  Grant  Thornton  for  re-performance  of  the  FY  2001  OMB  Circular  A-133  audit  as 
recommended. 


Jonathan  Myrick 
Assistant  Controller 
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Grant  Thornton,  LLP  Comments 


Grant  Thornton® 

Accountant*  and  Management  Comultants 


January  30, 2003 


Ms.  Janet  Stem 

Office  of  the  Inspector  General 
Department  of  Defense 
400  Army  Navy  Drive 
Arlington  Virginia  22202-2884 

Dear  Ms.  Stem: 

Grant  Thornton  LLP  (“Grant  Thornton”  or  “we”)  believes  that  the  2001  audit  of  the  Center  for  Naval 
Analysis  Corporation  (“CNAC”)  complied  with  professional  standards  and  the  requirements  of  OMB 
Circular  A-133  related  to  the  audit  of  federal  programs. 

We  believe  that  the  extent  of  the  procedures  and  the  level  of  documentation  requested  by  the  IG  is 
generally  in  excess  of  the  professional  standards  and  the  requirements  of  OMB  Circular  A-133. 
However,  as  we  discussed  in  our  meeting  with  DoD  IG  staff,  we  will  agree  to  provide  additional 
documentation  with  respect  to  auditing  procedures,  audit  considerations  and  audit  conclusions  already 
performed  and  reached  by  Grant  Thornton  during  the  2001  audit  and  to  perform  certain  additional 
procedures  requested  by  the  IG  in  order  to  meet  the  IG  requirements.  We  will  provide  such  additional 
information  directly  to  the  IG  for  review  and  acceptance  prior  to  inclusion  in  the  2001  workpapers. 


Sincerely, 


Professional  Standards  Partner 


Suite  375 ' 

2070  Chain  Bridge  Road 
Vienna,  VA  22182-2536 
T  703,847.7500 
F  703.848.9580 
W  www.grantthomton.cnm 

Grant  Thornton  LLS 

us  MMttnr  of  Grant  Thornton  MermtioMl 
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Evaluation  Team  Members 

The  Deputy  Assistant  Inspector  General  for  Audit  Policy  and  Oversight,  Office  of  the 
Inspector  General  of  the  Department  of  Defense  prepared  this  report.  Personnel  of  the 
Office  of  the  Inspector  General  of  the  Department  of  Defense  who  contributed  to  the 
report  are  listed  below. 

Carolyn  R.  Davis 
Janet  Stern 
Laura  Rainey 
Sherry  D.  Angwafo 
Sharon  Vasquez 
Krista  S.  Gordon 


